When you supply us with products or services
We process the following (categories of) personal data of persons from whom we purchase products or services or who work for these suppliers:
- Name and address details (name, first names, initials, titles, gender, address, postal code, residence) as provided by the supplier;
- Other contact details (telephone number, e-mail address and similar data required for communication) as provided by the supplier;
- Data for the purpose of placing orders or purchasing services, calculating and recording fees and expenses, making payments and collecting receivables, including the bank account number as provided by the supplier;
- Other data of suppliers of which the processing is required by, or necessary to comply with, applicable laws or regulations.
When you apply to us for a position
When you apply to us for employment, we process the following (categories of) personal data:
- Contact details (name, first names, initials, titles, gender, address, postal code, city), as provided by you;
- Other contact details (telephone number, e-mail address and similar data required for communications), as provided by you;
- Nationality and date of birth, as provided by you;
- Availability, CV and employment history (copies of diplomas, lists of grades, internship evaluations, certificates, letters of reference), motivation letter as provided by you and where relevant for the vacancy: the results of a competence test taken;
- References as provided by you or a referent, data on the position for which the candidate has applied, notes on job interviews and written communications with you.
Other situations
Our office processes (categories of) personal data of third parties (such as persons who are not clients and of whom personal data can be found in our records, notaries, lawyers and other advisers with whom we are in contact, visitors to our website, or when you provide a reference for a data subject applying for a job with us):
- Name and address details (name, first names, initials, titles, gender, address, postal code, residence), to the extent that these data are provided to us;
- Other contact details (telephone number, e-mail address and similar data necessary for communication), to the extent that these data are provided to us;
- Data relating to a visit to our website, including the IP address, as set out in our Cookie Statement;
- If you are a referent: personal data included in the reference provided by you;
- Data relating to electronic messages originating from or intended for third parties and data required to maintain contact with these third parties;
- Other third-party data obtained from public sources (such as the Trade Register (Handelsregister), the Chamber of Commerce (Kamer van Koophandel) and the Land Register (Kadaster)) or provided to us by clients or third parties in the context of handling a case.
Processing of Citizen Service Numbers
We may only process your Citizen Service Number if we are required to do so by law, see Article 87 GDPR in conjunction with Article 46 of the Dutch GDPR Implementation Act). For example, we may process your Citizen Service Number to register you in the Trade Register and the UBO Register (see Article 10(2)(a) and Article 15a(2)(a) of the Trade Register Act Handelsregisterwet) and to comply with Article 33 et seq. of the Money Laundering and Terrorist Financing Prevention Act (Wet ter voorkoming van witwassen en finanicieren van terrorisme, Wwft).
On the basis of which legal processing grounds and for which purposes do we process your personal data?
We process your personal data on the basis of one or more of the following legal processing grounds:
- If this is necessary for the performance of an agreement to which you are a party or to perform precontractual acts at your request;
- If this is necessary to comply with statutory obligations;
- If this is necessary to justify our legitimate interests or the interests of a third party;
- Your consent.
If we process your personal data on the basis of your consent, we will ask you for your consent separately. You may withdraw your consent at any time. We draw your attention to the fact that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.
We use the above personal data for the purposes stated below, in respect of which we have indicated for each purpose on the basis of which of the abovementioned legal processing grounds (a through d) we do so. If the processing is based on the principle of ‘legitimate interest’, we briefly explain this interest. If you have any specific questions in this respect, please do not hesitate to contact us.
Purposes with corresponding processing grounds:
- to provide the services requested, such as drawing up and passing notarial deeds, providing advice, legalising signatures and copy collations and having data or deeds entered in register(s) such as the Trade Register, the UBO register, the Land Register and the Central Digital Repetorium (CDR), (the drawing up of) private deeds, the settlement of an estate, including the identification of the client and conducting a client investigation (a, b and c: enabling the provision and improvement of services, d for the CLTR);
- informing third parties at the request of clients (a and d);
- for our administration, including the calculation or recording of fees or benefits, income and expenses, the payment and collection of claims (including the use of collection agencies or bailiffs) (a, b and c: the importance of keeping proper records);
- to be able to deal with any complaints and disputes about our services (a, b and c: to defend rights, to maintain and improve existing relationships by means of proper handling of complaints and to improve the quality of our services);
- to maintain contact and communicate with you, e.g. to send invitations for events hosted by Q.G.M. or to send you information regarding current legal affairs, e.g. when you sign up to a Q.G.M. newsletter; (a, b, c: our interest in communicating and staying in contact with our clients, d);
- for processing your application for a position (a, b, c: our legitimate interest in assessing your suitability for the vacant position and d: consent if you wish to remain in the portfolio for a longer period, see: “Retention of your personal data”);
- for placing orders or purchasing services (a, b and c: our interest in being able to keep proper records);
- for conducting audits and other internal controls (a, b and c: our interest in being able to keep proper records);
- to grant you access to our office and for company security purposes (a, b and c: the importance of being able to carry out correct (visitor) administration and to protect our premises, our employees and the data in our possession);
- to provide you with access to our website, for the purpose of security and keeping track of user statistics of our website and to be able to show specific content such as videos (a, b and c: the importance of being able to offer you a safe and optimized website , d);
- to comply with our legal and statutory obligations including the as the Notary Act (Wet op het notarisambt, Wna), the Wwft, the Trade Register Act (Handelsregisterwet), the Land Register Act (Kadasterwet) and the Rules of Professional Conduct of the Notary (click here for more specific information) (b, c: the interest of being able to meet these obligations).
Additional information on the processing of personal data in notarial deeds
If our office prepares a notarial deed which contains your personal data, the notary must comply with legal regulations. These affect the processing of your personal data:
- The civil law notary is obliged to include certain (personal) data in the deed (see Article 40 Wna).
- Once the deed has been signed by the notary, it becomes an official piece of evidence. At that point nothing can be changed, not even if the personal details are incorrect. If any changes are necessary, the notary must draw up a new deed which includes the change.
- The civil law notary is obliged to check certain (personal) data in the Basic Registration of Persons (Basisregistratie Personen, BRP), in the Trade Register (Handelsregister van de Kamer van Koophandel) and the Land Registry (Kadaster).
- The civil law notary is obliged to check your identity (see Article 33 Wwft and Article 39 Wna). To this end he must request a valid identity document from you. The civil law notary verifies the authenticity of Dutch identity documents through the Verification Information System (Verificatie Informatie Systeem) of the BKR Foundation (Stichting BKR) and uses a WID scanner.
- Your personal data are subject to the professional secrecy of the civil law notary. Unauthorised persons do not have access to the data.
To whom do we provide your personal data?
We do not provide your personal data to third parties (‘recipients’ within the meaning of the applicable privacy legislation), unless this is necessary for the proper performance of the purposes set out in this Privacy Statement, if the law requires us to do so, or if you have provided your consent to this end.
The third parties to whom the personal data are made available are obliged to handle your personal data confidentially. If these parties qualify as a ‘data processor’ within the meaning of the applicable privacy legislation, we will ensure that a data processing agreement is concluded with these parties, which complies with the requirements included in the GDPR. Third parties which offer services to us as an independent data controller, such as accountants, the Chamber of Commerce (Kamer van Koophandel) and the tax authorities, are themselves responsible for the (further) processing of your personal data in accordance with the applicable privacy legislation.
- the Land Register (pursuant to Article 26 of the Land Register Act (Handelsregisterwet);
- the Chamber of Commerce (Kamer van Koophandel);
- the Central Register of Living Wills (Centraal Levenstestamentenregister, CLTR);
- software suppliers such as the suppliers of our document management system with time recording, the party that hosts our website, our cloud provider, and the party from which we purchase our e-mail service;
- other suppliers, such as bailiffs, lawyers, advisers, other notary offices, accountants, courier services, assessment agencies, and translation agencies;
- tax authorities;
- with our legal successors if we are acquired by or merged with another company, for example through bankruptcy and also with third parties involved in such proposed or actual business transaction;
- courts and government institutions;
- other parties, such as regulators (e.g. reporting of unusual transactions to the Financial Intelligence Unit (FIU) Netherlands pursuant to Article 16 Wwft) and other authorities where required by law or with your consent.
In order to provide our services, we can transfer your personal data to a recipient in a country outside the European Economic Area with a lower degree of protection of personal data than European Union law offers. In that case, we will ensure that such a transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract prepared and approved for that purpose by the European Commission, and will assess whether any additional measures are necessary to guarantee an appropriate level of protection of your personal data. Please do not hesitate to reach out to us if you wish to receive more information about the appropriate or suitable safeguards in place for data transfers outside of the European Economic Area or if you would like to obtain a copy of those safeguards.
Retention of your personal data
We do not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes included in this Privacy Statement. More specifically, we apply the following retention periods:
- On the basis of Article 58 Wna and Article 12(1) of the 1995 Archives Act, notarial deeds are kept at our office for 20 years. After that the deeds may be transferred to the general depository in Winschoten. Notarial deeds are kept in perpetuity.
- Personal data which are processed on the basis of the obligations pursuant to the Wwft shall, pursuant to Article 33(3) of the Wwft, be retained for five years after the time at which the business relationship was terminated or for five years after the performance of the transaction in question. With respect to reports of unusual transactions, the personal data processed for this purpose shall, pursuant to Article 34(2) of the Wwft, be retained for five years after the time at which the report was made or the time at which the message was received from FIU Nederland;
- The personal data provided to us with regard to your application for a position will be stored for up to four weeks after the end of the application procedure. We can keep your personal data on file for up to one year after the end of the application procedure if you consent to this. This enables us to approach you for any future vacancies. If our office hires you, the personal data you provided with regard to your application will become part of your personnel file.
- Personal data that must be kept on the basis of Article 52 of the Dutch State Taxes Act will be kept for 7 years (from the end of the year in which the data in question have lost their current value for the (tax-)related business operations) in connection with the tax retention obligation incumbent on us pursuant to Article 52(4) of the Dutch State Taxes Act.
For the retention periods of the information obtained via cookies on our website, we refer to our Cookie Statement.
The abovementioned specific retention periods can be extended if statutory retention obligations apply or will become applicable. We may also retain the personal data for a longer period of time if this is necessary in light of our legitimate interests, e.g. for the handling of incidents and/or legal disputes.
Your privacy rights
You have the following rights in respect of the processing of your personal data by us:
- the right to request whether we process your personal data and if so, the right to access your personal data and to receive information about the processing of your personal data;
- the right to rectification of your personal data, if these are incorrect or incomplete;
- the right to have your personal data deleted (‘right to be forgotten’);
- the right to object to the processing of your personal data or to limit the processing of your personal data;
- the right to withdraw your consent for the processing of your personal data, if the processing is based on your consent;
- the right to receive or surrender your personal data to a third party appointed by you in a structured, customary and machine-readable form (‘right to data portability’).
We do not use automated decision-making within the meaning of Article 22 GDPR.
To exercise your rights, please contact us using the contact details at the top of this Privacy Statement.
In order to prevent that we disclose information to the wrong person, we can ask you for additional information to verify your identity. In principle, we will inform you of whether we can comply with your request within one month after receipt of your request. In specific cases, for example when it concerns a complex request, this term may be extended by two months. We will inform you of such an extension within one month after receiving your request. On the basis of the applicable privacy legislation, we can refuse your request under certain circumstances. For example, a notary is not allowed to remove your personal data from a notarial deed and in certain cases we can refuse access to the personal data that we have processed for FIU notifications (see Article 23(3) Wwft). If we refuse your request, we will explain to you why.
You can find more information about your privacy rights on the website of the Dutch Data Protection Authority.
Security
We have taken appropriate technical and organisational measures to secure your personal data against unauthorised or unlawful processing and against loss, destruction, damage, modification or publication. If you have any questions about the security of your personal data, or if you suspect or see signs of misuse, please contact us via david.meijeren@qgmlaw.com.
Complaints
If you have a complaint about the processing of your personal data by us, we will be happy to work together to find a solution. If this does not lead to the desired result, you will have the right to file a complaint with the competent supervisory authority. In the Netherlands, this is the Dutch Data Protection Authority. If you live or work in another country of the European Union, you can file a complaint with the supervisory authority of that country.
Amendments
This Privacy Statement was last amended on 21 May 2024. We reserve the right to amend this Privacy Statement. The most recent version of this Privacy Statement will always be posted on our website. If substantial amendments are made that could have a significant impact on one or more of the data subjects involved, we will endeavour to inform those data subjects directly.